# Limit RTC port range for client **URL:** \ **Category:** mediasoup libraries\ **Created:** [December 9, 2019, 6:31am UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453 "2019-12-09T06:31:19Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![mkh](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/mkh/32/145_2.png) [@mkh](https://mediasoup.discourse.group/u/mkh)\ **Post date:** [December 9, 2019, 6:31am UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/1 "2019-12-09T06:31:19Z")
We’ve been asked all the time by some organizations, that security matters for them, about required ports to be opened on their network/firewall for using our service, which is base on mediasoup of course. I know we can set the `rtcMinPort`/`rtcMaxPort` in server side. However I wonder is there a way to set such a limit also for clients? Or users have to open WHOLE in/out ports in their network and devices (UDP at least)? ---
**Author:** ![ibc](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/ibc/32/1540_2.png) [@ibc](https://mediasoup.discourse.group/u/ibc)\ **Post date:** [December 9, 2019, 10:45pm UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/2 "2019-12-09T22:45:36Z")
For questions like this, please first the [WebRTC spec](https://www.w3.org/TR/webrtc/). There is nothing in there to narrow local ports, so nothing we can do to achieve that. ---
**Author:** ![ibc](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/ibc/32/1540_2.png) [@ibc](https://mediasoup.discourse.group/u/ibc)\ **Post date:** [December 9, 2019, 10:45pm UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/3 "2019-12-09T22:45:41Z")
Closed on December 9, 2019, 10:45pm UTC ---
**Author:** ![ibc](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/ibc/32/1540_2.png) [@ibc](https://mediasoup.discourse.group/u/ibc)\ **Post date:** [December 10, 2019, 7:24pm UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/4 "2019-12-10T19:24:08Z")
Opened on December 10, 2019, 7:24pm UTC ---
**Author:** ![mkh](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/mkh/32/145_2.png) [@mkh](https://mediasoup.discourse.group/u/mkh)\ **Post date:** [December 11, 2019, 2:23pm UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/5 "2019-12-11T14:23:16Z")
It seems using TURN server is the only option for networks with strict security rules. However [some guys have found an interesting solution](https://sourcey.com/articles/webrtc-port-forwarding-pseudo-turn-proxy) by implementing the TURN protocol over the top of the native PeerConnection. For those who are looking for the preferred firewall settings in the client side I did some tests. Fortunately opening inbound ports which is the main concern for network admins is not necessary. Here’s the require firewall settings against RTP data: **Inbound UDP or TCP:** Deny All **Outbound UDP or TCP:** Allow the port range defined in mediasoup server (i.e. `rtcMinPort` / `rtcMaxPort`) ---
**Author:** ![madabhaviamit](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/madabhaviamit/32/1418_2.png) [@madabhaviamit](https://mediasoup.discourse.group/u/madabhaviamit)\ **Post date:** [December 14, 2019, 5:07am UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/6 "2019-12-14T05:07:16Z")
Hi mkh, We are using mediasoup in our organization and due to strict security reason the ports are not allowed to be opened. For this case we use turn servers to direct the traffic into our data center, Since port 80 and 443 are always open in organizations. The traffic goes to the mediasoup servers mentioned rtc port of the ice candidate via the turn server… ---
**Author:** ![mkh](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/mkh/32/145_2.png) [@mkh](https://mediasoup.discourse.group/u/mkh)\ **Post date:** [December 14, 2019, 5:30am UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/7 "2019-12-14T05:30:21Z")
Hi @madabhaviamit Thanks for the confirmation. I have zero experience on using TURN server. So you’ve configured the TURN server to listen on a single TCP port (443 or 80), right? Can I ask what TURN server do you use and how does it affect the latency and quality? ---
**Author:** ![madabhaviamit](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/madabhaviamit/32/1418_2.png) [@madabhaviamit](https://mediasoup.discourse.group/u/madabhaviamit)\ **Post date:** [December 14, 2019, 12:03pm UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/8 "2019-12-14T12:03:27Z")
Hi Mohsen, Yes, I have configured the turn server to listen on port 443 over ssl. I have a document made on how to setup up the turn server with all the necessary links. Once done with the setup you just need to mention the turn server’s ip, port, username and password to connect. It is also possible to mention the stun and turn server urls in mediasoup client library. I will share the document with you in sometime. ---
**Author:** ![mkh](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/mkh/32/145_2.png) [@mkh](https://mediasoup.discourse.group/u/mkh)\ **Post date:** [December 14, 2019, 12:08pm UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/9 "2019-12-14T12:08:43Z")
Wow! That would be great. I’m looking forward to your document. Thank you. ---
**Author:** ![Aidar](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@Aidar](https://mediasoup.discourse.group/u/Aidar)\ **Post date:** [May 20, 2020, 9:07am UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/10 "2020-05-20T09:07:52Z")
Hi, is the document ready? ---
**Author:** ![mindlesswaisty](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mindlesswaisty](https://mediasoup.discourse.group/u/mindlesswaisty)\ **Post date:** [February 1, 2021, 11:07pm UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/11 "2021-02-01T23:07:57Z")
Hi Aidar Were you able to find your way around this? ---
**Author:** ![RumOldField](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/rumoldfield/32/845_2.png) [@RumOldField](https://mediasoup.discourse.group/u/RumOldField)\ **Post date:** [February 18, 2021, 1:19pm UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/13 "2021-02-18T13:19:54Z")
Hi Amit, I’m also trying to solve this problem. Right now it seems that for general reliability you really need a TURN server in front of mediasoup. Some firewalls are just too locked down. I am looking into Coturn as the TURN server, but am yet to succeed in setting it up. Would love to see the doc you speak of! Sam ---
**Author:** ![OllieJones](https://yyz2.discourse-cdn.com/free1/user_avatar/mediasoup.discourse.group/olliejones/32/850_2.png) [@OllieJones](https://mediasoup.discourse.group/u/OllieJones)\ **Post date:** [February 26, 2021, 12:12pm UTC](https://mediasoup.discourse.group/t/limit-rtc-port-range-for-client/453/14 "2021-02-26T12:12:38Z")
For the sake of testing, and maybe even production, you might investigate the STUN / TURN vendor [xirsys.com](http://xirsys.com). They have a generous free tier, a global STUN/TURN network, and reasonable pricing for production. (I’ve used their free tier for a few proof-of-concept operations. Other than that I have no affiliation.)